1. Field of the Invention
The present invention generally relates to methods for the identification of unknown networks, and in particular to methods using a graph space including nodes and links representing network actors and their interactions to identify unknown illicit networks.
2. Background Description
In the art of illicit network identification a universe of actors is represented by nodes of a graph. There is a vector of node attributes associated with each node. Actors interact with each other, and their interactions are represented by the links of the graph, each link having a vector of attributes associated with it. It is assumed that there are subsets of the universe of actors that belong to illicit networks. Multiple networks may exist. Networks may interact with each other and compete for resources. The goal of network identification is to accurately determine which actors are members of an illicit network. We will call them “bad” nodes as opposite to “good” nodes.
Central to the problem of illicit network identification is the problem of recognition of patterns in the input data. Some patterns are based on the node attributes only, when the fact of a membership in the network is defined solely by an actor's attributes. Skilled adversaries easily defeat this pattern. Other patterns may be based on the links of a given node and that link's attributes. Still other patterns may be based on the topology of the network itself as, for example, with a particular hierarchical network structure. Further, the properties of the network as a whole (e.g., network size and composition) may be telling. In the general case, all these patterns are present simultaneously in the complex interactions that define network behavior.
Prior art methodologies generally employ the simplification of two-dimensional data-sets, which makes it difficult to analyze all these patterns together. Therefore, what is needed for viable network identification is a capability for analyzing the entire graph space.